@coderook/cli 0.34.6 → 0.34.8

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.6",
+  "version": "0.34.8",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cbx/src/core/secret_patterns.js

@@ -90,7 +90,13 @@ exports.CREDENTIAL_PATTERNS = [
     {
         id: "slack-token",
         name: "a Slack token",
-        match: /\bxox[baprs]-[0-9A-Za-z-]{10,}/g,
+        /*
+          Slack's tokens open with a number group: xoxb-1234…-5678…-AbC…. The
+          loose form also took "xoxb-test-bot-token", which is how test suites
+          spell a fake one — an open-source project's integration tests were
+          refused six times over for them.
+        */
+        match: /\bxox[baprs]-\d+-[0-9A-Za-z-]{10,}/g,
     },
     {
         id: "stripe-live-key",

package/dist/cbx/src/core/upload.js

@@ -180,6 +180,8 @@ class Uploader {
         return new Map(this.plannedDigests);
     }
     planningCreatedRepositoryId = null;
+    /** Set once the send has begun to move objects; see execute. */
+    sendingBegan = false;
     /** Attached to every object write after the server admits the exact plan. */
     activeQuoteId = null;
     constructor(credentials) {
@@ -409,9 +411,22 @@ class Uploader {
     /** Execute a still-active quote produced by {@link plan}. */
     async execute(request, plan, report) {
         this.activeQuoteId = plan.quoteId;
+        this.sendingBegan = false;
         try {
             return await this.runPass({ ...request, repositoryId: plan.repositoryId }, report);
         }
+        catch (error) {
+            /*
+              A first save that stops before a single object has moved leaves no
+              project behind. The plan created it, and it used to stay — empty, at
+              v0 — after a refusal that had just said nothing was changed. Once
+              objects have gone up it stays, because a retry reuses them.
+            */
+            if (plan.repositoryCreated && !this.sendingBegan) {
+                await this.cancelPlan(plan, true).catch(() => undefined);
+            }
+            throw error;
+        }
         finally {
             this.activeQuoteId = null;
         }
@@ -609,6 +624,17 @@ class Uploader {
         const HASH_LANES = 8;
         const measured = new Array(sending.length).fill(null);
         let hashed = 0;
+        /*
+          Files whose bytes are no longer the bytes the plan priced.
+    
+          The service holds a save to what its plan named, so a file written to
+          between the plan and the send went up as an object nobody had asked
+          for and was refused as "a file that was not part of what it asked to
+          send", with advice to update the app. Found by saving a folder while a
+          program appended to a text file in it. Caught here instead, before
+          anything is sent, and named for what it is.
+        */
+        const changedSincePlan = [];
         let cursor = 0;
         /** Throttled: twenty thousand sends is its own cost, and nobody reads them. */
         let told = 0;
@@ -691,6 +717,7 @@ class Uploader {
                   and a match there means the digest already taken still describes the
                   bytes. Reading is what costs; deciding not to read is free.
                 */
+                const fromPlan = this.planning ? undefined : this.plannedDigests.get(file.path);
                 const remembered = this.plannedDigests.get(file.path) ??
                     request.knownDigests?.get(file.path);
                 if (remembered &&
@@ -722,6 +749,8 @@ class Uploader {
                     hashed += 1;
                     continue;
                 }
+                if (fromPlan && fromPlan.sha256 !== digest)
+                    changedSincePlan.push(file.path);
                 this.plannedDigests.set(file.path, { size, mtimeMs, sha256: digest });
                 measured[index] = {
                     path: file.path,
@@ -752,6 +781,16 @@ class Uploader {
         if (!declarations.length && !deletions.size) {
             throw new Error("Nothing is selected to upload");
         }
+        if (changedSincePlan.length) {
+            const one = changedSincePlan.length === 1;
+            const shown = changedSincePlan.slice(0, 5).join(", ");
+            const rest = changedSincePlan.length > 5 ? ` and ${changedSincePlan.length - 5} more` : "";
+            throw new Error(`${changedSincePlan.length} file${one ? "" : "s"} changed while the save was running, ` +
+                `so nothing was sent: ${shown}${rest}. Something is still writing to ${one ? "it" : "them"}. ` +
+                `Save again once ${one ? "it has" : "they have"} stopped changing, or leave ${one ? "it" : "them"} ` +
+                `out — untick ${one ? "it" : "them"} in the app, or add ${one ? "it" : "them"} to .gitignore. ` +
+                `Nothing was changed on your account.`);
+        }
         return { declarations, totalBytes };
     }
     /**
@@ -809,6 +848,66 @@ class Uploader {
      * that did not arrive, while past here there is a version. Keeping the
      * boundary a function call rather than a comment makes that legible.
      */
+    /**
+     * Refuse a save that would leave out files somebody chose, naming why.
+     *
+     * Called as soon as the reading is done as well as before the version is
+     * named. Only the second existed, after the plan had already created the
+     * project, so a first save refused for one locked file left an empty
+     * project behind while saying "Nothing was changed on your account".
+     */
+    refuseUnreadable(dropped, readFailures) {
+        const shown = dropped.slice(0, 5).join(", ");
+        const rest = dropped.length > 5 ? ` and ${dropped.length - 5} more` : "";
+        const details = dropped
+            .map((name) => readFailures.get(name) ? `${name}: ${readFailures.get(name)}` : "")
+            .filter(Boolean)
+            .slice(0, 3)
+            .join("; ");
+        /*
+          Say what to do about it. Refusing is right — a version quietly missing
+          a file somebody chose is the one failure a backup tool must never have
+          — but the message stopped at the refusal, and the person is left with
+          a list of paths and no idea that the fix is either closing whatever
+          holds them or unticking them. Almost every case is a file another
+          program has open, so that is what it says.
+        */
+        /*
+          Each cause named for what it is. Every failure used to be put down to
+          "another program may have a file open", which was wrong for a file
+          this account may not read and for one deleted mid-save, and "untick"
+          means nothing on the command line, where there is nothing to tick.
+          Found by saving a folder with one file held open and one with
+          reading denied.
+        */
+        const reasonOf = (name) => readFailures.get(name) ?? "";
+        const causes = new Set(dropped.map((name) => {
+            const reason = reasonOf(name);
+            if (reason.includes("ignore rules"))
+                return "ignored";
+            if (/EACCES|EPERM|permission|access is denied/i.test(reason))
+                return "permission";
+            if (/ENOENT|no such file/i.test(reason))
+                return "gone";
+            return "busy";
+        }));
+        const said = [];
+        if (causes.has("busy"))
+            said.push("Another program has a file open: close it.");
+        if (causes.has("permission"))
+            said.push("This account is not allowed to read a file: change its permissions.");
+        if (causes.has("gone"))
+            said.push("A file was deleted or moved while the save was running.");
+        if (causes.has("ignored"))
+            said.push("A file is excluded by the project's ignore rules: change the rules.");
+        throw new Error(`${dropped.length} selected file${dropped.length === 1 ? "" : "s"} could not be included, ` +
+            `so nothing was saved: ${shown}${rest}. ` +
+            `${said.join(" ")} Or leave ${dropped.length === 1 ? "it" : "them"} out — untick ` +
+            `${dropped.length === 1 ? "it" : "them"} in the app, or add ${dropped.length === 1 ? "it" : "them"} ` +
+            `to .gitignore — and save again. ` +
+            `Nothing was changed on your account.` +
+            (details ? ` Details: ${details}` : ""));
+    }
     async publishVersion(at) {
         const { request, repositoryId, declarations, uploaded, reused, prior, everything, ticked, deletions, readFailures, vanished, totalBytes, progress, report, } = at;
         // 4. Name the version, which is what makes the upload visible.
@@ -837,7 +936,7 @@ class Uploader {
         const contents = [
             ...uploaded,
             ...reused.map((file) => {
-                const held = prior.get(file.path);
+                const held = file.storedAs ?? prior.get(file.path);
                 /*
                   Republished in the shape it was already stored in. A file kept in
                   pieces names the same pieces; flattening it to one object here would
@@ -872,7 +971,7 @@ class Uploader {
                             : { objectId: held.objectId }),
                     sourceSize: held.sourceSize,
                     storedSize: held.storedSize,
-                    mediaType: held.mediaType,
+                    mediaType: file.mediaType,
                     executable: request.executable?.get(file.path) ?? held.executable,
                 };
             }),
@@ -899,31 +998,8 @@ class Uploader {
                 ...[...ticked].filter((chosen) => !named.has(chosen) && !deletions.has(chosen)),
             ]),
         ];
-        if (dropped.length) {
-            const shown = dropped.slice(0, 5).join(", ");
-            const rest = dropped.length > 5 ? ` and ${dropped.length - 5} more` : "";
-            const details = dropped
-                .map((name) => readFailures.get(name) ? `${name}: ${readFailures.get(name)}` : "")
-                .filter(Boolean)
-                .slice(0, 3)
-                .join("; ");
-            /*
-              Say what to do about it. Refusing is right — a version quietly missing
-              a file somebody chose is the one failure a backup tool must never have
-              — but the message stopped at the refusal, and the person is left with
-              a list of paths and no idea that the fix is either closing whatever
-              holds them or unticking them. Almost every case is a file another
-              program has open, so that is what it says.
-            */
-            const excluded = dropped.some((name) => readFailures.get(name)?.includes("ignore rules"));
-            throw new Error(`${dropped.length} selected file${dropped.length === 1 ? "" : "s"} could not be included, ` +
-                `so nothing was saved: ${shown}${rest}. ` +
-                (excluded
-                    ? `At least one is excluded by the project's ignore rules. Change the rules or untick it and try again. `
-                    : `Another program may have a file open. Close it or untick the file and try again. `) +
-                `Nothing was changed on your account.` +
-                (details ? ` Details: ${details}` : ""));
-        }
+        if (dropped.length)
+            this.refuseUnreadable(dropped, readFailures);
         const sourceBytes = contents.reduce((total, item) => total + item.sourceSize, 0);
         const storedBytes = contents.reduce((total, item) => total + item.storedSize, 0);
         /*
@@ -1016,7 +1092,7 @@ class Uploader {
         const manifest = Object.keys(acceptedManifest).length
             ? acceptedManifest
             : {
-                ...Object.fromEntries(reused.map((file) => [file.path, prior.get(file.path).sha256])),
+                ...Object.fromEntries(reused.map((file) => [file.path, (file.storedAs ?? prior.get(file.path)).sha256])),
                 ...Object.fromEntries(declarations.map((declaration) => [declaration.path, declaration.sha256])),
             };
         /*
@@ -1031,6 +1107,16 @@ class Uploader {
           the very end of a save.
         */
         const sentDigest = new Map(declarations.map((declaration) => [declaration.path, declaration.sha256]));
+        /*
+          A file named from bytes already stored, at a path the last version did
+          not have, holds those bytes here too. Without this a renamed folder was
+          saved correctly and then reported as "behind" file by file, because this
+          record looked its old digest up by its new path and found nothing.
+        */
+        for (const file of reused) {
+            if (file.storedAs)
+                sentDigest.set(file.path, file.storedAs.sha256);
+        }
         const onDisk = new Set(everything.map((file) => file.path));
         const local = Object.fromEntries(everything.flatMap((file) => {
             const sent = sentDigest.get(file.path);
@@ -1104,6 +1190,8 @@ class Uploader {
      * rather than before.
      */
     async sendObjects(at) {
+        if (!this.planning)
+            this.sendingBegan = true;
         const { request, repositoryId, prior, 
         /*
           Bound under a distinct name on purpose. `runSection` declares its own
@@ -1708,6 +1796,12 @@ class Uploader {
           than from the disk.
         */
         const hashed = await this.hashSelection(request, sending, deletions, readFailures, vanished, report);
+        /*
+          Before the project is created or anything priced: see refuseUnreadable.
+          `vanished` holds every chosen file that is gone or could not be read.
+        */
+        if (vanished.length)
+            this.refuseUnreadable([...new Set(vanished)], readFailures);
         /*
           A file that is exactly what the last version held is kept, not sent.
     
@@ -1723,31 +1817,48 @@ class Uploader {
           same bytes, and the previous version's object for them — a pack slice,
           its chunks, or a plain object — is named again instead.
         */
-        const keptAsItWas = (declaration) => {
+        const stored = (was) => !!was && !!(was.pack?.objectId || was.chunks?.length || was.objectId);
+        /*
+          Matched by what a file is, not only by where it sits.
+    
+          Same path and same bytes was the only reuse, so renaming a folder sent
+          every file in it again: the service recognises a stored object by its
+          digest but not a slice of a pack, and small files live in packs. Moving
+          a 2,192-file folder in a copy of the Cheat Engine sources re-sent all of
+          it, 5.5 MB, to record bytes the project already held. Any file in the
+          previous version with the same digest is the same bytes, wherever it was.
+        */
+        const priorByDigest = new Map();
+        for (const was of prior.values()) {
+            if (stored(was) && !priorByDigest.has(was.sha256))
+                priorByDigest.set(was.sha256, was);
+        }
+        const storedAs = (declaration) => {
             const was = prior.get(declaration.path);
-            return (!!was &&
-                was.sha256 === declaration.sha256 &&
-                !deletions.has(declaration.path) &&
-                !!(was.pack?.objectId || was.chunks?.length || was.objectId));
+            if (stored(was) && was.sha256 === declaration.sha256)
+                return was;
+            return priorByDigest.get(declaration.sha256) ?? null;
         };
+        const keptAsItWas = (declaration) => storedAs(declaration) !== null;
         const declarations = hashed.declarations.filter((one) => !keptAsItWas(one));
         let totalBytes = hashed.totalBytes;
         for (const one of hashed.declarations) {
-            if (!keptAsItWas(one))
+            const held = storedAs(one);
+            if (!held)
                 continue;
             totalBytes -= one.size;
-            const held = prior.get(one.path);
             reused.push({
                 path: one.path,
                 sourceSize: held.sourceSize,
                 storedSize: held.storedSize,
-                mediaType: held.mediaType,
+                mediaType: one.mediaType,
                 added: 0,
                 removed: 0,
                 included: true,
                 deleted: false,
                 binary: false,
                 lines: 0,
+                ...(held === prior.get(one.path) ? {} : { storedAs: held }),
             });
         }
         (0, profile_js_1.counted)("files kept as they were", hashed.declarations.length - declarations.length);

package/dist/cli/src/cli.js

@@ -376,7 +376,7 @@ async function commandProjects() {
     const width = Math.max(...all.map((project) => project.slug.length));
     for (const project of all) {
         console.log(`${accent(project.slug.padEnd(width))}  v${String(project.versionCount).padEnd(4)}` +
-            `${String(project.fileCount).padStart(6)} files  ${bytes(project.storedBytes).padStart(9)}` +
+            `${String(project.fileCount).padStart(6)} ${project.fileCount === 1 ? "file " : "files"}  ${bytes(project.storedBytes).padStart(9)}` +
             `  ${dim(project.visibility)}`);
     }
     return 0;
@@ -454,7 +454,7 @@ async function commandStatus(parsed) {
     const files = found.filter((file) => !file.deleted);
     console.log(bold(node_path_1.default.basename(folder)) + dim(`  ${folder}`));
     console.log(link
-        ? `Account holds ${accent(`v${link.sequence}`)} · ${Object.keys(link.manifest).length} files ${dim(`(${link.slug})`)}`
+        ? `Account holds ${accent(`v${link.sequence}`)} · ${Object.keys(link.manifest).length} ${Object.keys(link.manifest).length === 1 ? "file" : "files"} ${dim(`(${link.slug})`)}`
         : dim("This folder is not linked to a project."));
     if (!link) {
         const likes = (0, folder_match_js_1.similarProjects)(await (0, api_js_2.projects)().catch(() => []), node_path_1.default.basename(folder));
@@ -574,8 +574,10 @@ async function commandStatus(parsed) {
         return 0;
     }
     console.log(`\n${files.length} file${files.length === 1 ? "" : "s"} to submit:`);
+    /* New is not changed: a file the saved version never had was listed as "changed". */
     for (const file of files.slice(0, 50)) {
-        console.log(`  ${accent("changed")}  ${file.path}`);
+        const fresh = !baseline?.has(file.path);
+        console.log(`  ${fresh ? green("new    ") : accent("changed")}  ${file.path}`);
     }
     if (files.length > 50)
         console.log(dim(`  …and ${files.length - 50} more`));
@@ -728,13 +730,14 @@ async function digestOfFile(full) {
  */
 function noteKeptDeletions(folder, baseline, syncing) {
     if (syncing || !baseline?.size)
-        return;
+        return 0;
     const gone = [...baseline.keys()].filter((file) => !(0, node_fs_1.existsSync)(node_path_1.default.join(folder, ...file.split("/"))));
     if (!gone.length)
-        return;
+        return 0;
     console.log(dim(`${gone.length} file${gone.length === 1 ? "" : "s"} deleted here ${gone.length === 1 ? "is" : "are"} still in the saved version` +
         ` (${gone.slice(0, 3).join(", ")}${gone.length > 3 ? ", …" : ""}). A save adds and updates;` +
         ` run cbx submit --sync to remove ${gone.length === 1 ? "it" : "them"}.`));
+    return gone.length;
 }
 /*
   The service names each clash by its kind ("text_region", "add_add", …).
@@ -914,6 +917,20 @@ async function commandSubmit(parsed) {
         }
     }
     if (!files.length) {
+        /*
+          Deleted files are not "nothing". A plain save never removes, so a
+          folder with 1,723 files deleted from it was told it "matches the saved
+          version" straight after status had listed every one of them — found by
+          deleting a folder from a copy of the Cheat Engine sources.
+        */
+        if (!hasFlag(parsed, "sync")) {
+            const kept = [...(baseline?.keys() ?? [])].some((file) => !(0, node_fs_1.existsSync)(node_path_1.default.join(folder, ...file.split("/"))));
+            if (kept) {
+                console.log("Nothing new to submit.");
+                noteKeptDeletions(folder, baseline, false);
+                return 0;
+            }
+        }
         // Having nothing to send is not the same as holding the whole version:
         // a merge can leave this folder with an older copy of somebody else's
         // file. Saying so is what stops "nothing to do" from reading as "level".
@@ -1263,7 +1280,7 @@ The connection failed: ${text}`));
         */
         console.log(`\nSomebody else saved first, and ${result.mergeTrack.conflicts.length === 1
             ? "one file overlaps"
-            : `${result.mergeTrack.conflicts.length} files overlap`}.`);
+            : `${result.mergeTrack.conflicts.length} ${result.mergeTrack.conflicts.length === 1 ? "file overlaps" : "files overlap"}`}.`);
         console.log(`Your work is complete and kept as ${accent(result.mergeTrack.reference)}:`);
         for (const conflict of result.mergeTrack.conflicts.slice(0, 20)) {
             console.log(`  ${red(conflict.path)}  ${dim(conflictWords(conflict.kind))}`);

package/dist/cli/src/mcp.js

@@ -136,7 +136,7 @@ const TOOLS = [
             if (!saved.length)
                 return "No versions saved yet.";
             return saved
-                .map((one) => `v${one.sequence}  ${one.createdAt.slice(0, 10)}  ${one.fileCount} files  ` +
+                .map((one) => `v${one.sequence}  ${one.createdAt.slice(0, 10)}  ${one.fileCount} ${one.fileCount === 1 ? "file" : "files"}  ` +
                 `${bytes(one.storedSize)}  ${one.message || "(no message)"}`)
                 .join("\n");
         },
@@ -167,7 +167,7 @@ const TOOLS = [
             if (files.length > shown.length) {
                 lines.push(`… and ${files.length - shown.length} more`);
             }
-            return `v${version.sequence} · ${files.length} files\n${lines.join("\n")}`;
+            return `v${version.sequence} · ${files.length} ${files.length === 1 ? "file" : "files"}\n${lines.join("\n")}`;
         },
     },
     {

package/dist/cli/src/project_commands.js

@@ -385,7 +385,7 @@ async function commandVersions(parsed) {
             ...version.labels.map((label) => (0, colour_js_1.accent)(label.name)),
         ].filter(Boolean);
         console.log(`  ${(0, colour_js_1.accent)(`v${version.sequence}`).padEnd(16)} ${when.padEnd(22)}` +
-            `${String(version.fileCount).padStart(5)} files  ${bytes(version.storedSize)}` +
+            `${String(version.fileCount).padStart(5)} ${version.fileCount === 1 ? "file " : "files"}  ${bytes(version.storedSize)}` +
             (marks.length ? `  ${marks.join(" ")}` : ""));
         if (version.message)
             console.log(`    ${(0, colour_js_1.dim)(version.message)}`);

package/dist/cli/src/service_commands.js

@@ -569,7 +569,8 @@ async function commandDelete(parsed) {
     if (!project)
         return 1;
     if (parsed.flags.get("yes") !== true) {
-        console.log(`This deletes ${(0, colour_js_1.bold)(project.name)} — ${project.versionCount} versions, ` +
+        console.log(`This deletes ${(0, colour_js_1.bold)(project.name)} — ${project.versionCount} ` +
+            `${project.versionCount === 1 ? "version" : "versions"}, ` +
             `${bytes(project.storedBytes)}.`);
         console.log((0, colour_js_1.dim)("It is kept for 30 days before the storage is reclaimed."));
         const prompt = (0, promises_1.createInterface)({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.6",
+  "version": "0.34.8",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",